CVE-2026-10587

Executive Summary

CVE-2026-10587 is an out-of-bounds write vulnerability in Lenovo System Management Mode (SMM) code that allows a local attacker with high privileges to corrupt memory and modify power management settings. Successful exploitation results in full compromise of confidentiality, integrity, and availability (CVSS 6.8) at the firmware level, bypassing OS-level security controls including Secure Boot and VBS. All Lenovo consumer and commercial devices with affected firmware versions are exposed; the vendor has issued advisory LEN-220440 with per-model firmware updates.

Technical Analysis

The vulnerability resides in Lenovo's SMM (System Management Mode) handler code responsible for processing power management configuration requests. SMM is a privileged x86 execution mode triggered by System Management Interrupts (SMI), running at the highest privilege level (ring -2) with access to the entire physical memory space.

Vulnerability Mechanism:

The flaw is an out-of-bounds write (CWE-787) in the SMM communication buffer handler. When a software SMI is triggered, the SMM code receives a pointer to a communication buffer in system memory. The handler validates the buffer size but fails to validate an offset or index used during a write operation to the power management configuration data structure. A local privileged attacker can craft a request where the write index is deliberately set to a value outside the intended data structure boundaries, causing the SMM handler to write data past the buffer's end.

Because SMM runs with System Management RAM (SMRAM) mapped into its address space, the out-of-bounds write can corrupt:

• Adjacent SMM handler data structures
• SMM code pointers (enabling SMM code execution)
• Saved processor state in the SMM state save area

Attack Surface:

• Entry vector: Software SMI (int 0x82 in some implementations) via the ACPI/APIC interface, accessible from kernel-mode code.
• Prerequisites: Attacker must already have Local Administrator or SYSTEM privileges (CVSS PR:H). This typically means a prior exploit chain obtained kernel-level code execution through a browser bug, driver vulnerability, or social engineering.
• Impact: From SMM, the attacker can install a persistent firmware rootkit using SMM-based hooking (e.g., SMI handler modification) that survives OS reinstallation, disk reformatting, and firmware flashing (if the SMM write region is unprotected).

Code-Level Explanation (representative pseudo-code):

SmmPowerMgmtHandler(SmiParams* pParams) {
    // pParams->data_offset is derived from attacker-controlled input
    UINT8* config = (UINT8*)&g_PowerConfig;
    UINT32 offset = pParams->data_offset;  // NO bounds check!
    
    // Out-of-bounds write at config[offset]
    *(UINT32*)(config + offset) = pParams->value;
}

The lack of validation on data_offset combined with an unchecked multipler or index calculation enables arbitrary writes within the SMRAM region, potentially reaching the SMM state save area where the attacker can control the RIP used on RSM.

Exploitation Scenarios

Scenario 1: Full Firmware Persistence via SMM Rootkit

1. Reconnaissance: Attacker identifies a Lenovo corporate workstation with outdated firmware (e.g., ThinkPad models with firmware before LEN-220440 mitigation). Target discovery can be done via Lenovo Vantage inventory reports or by querying firmware version via wmic bios get smbiosbiosversion.

2. Initial Access → Kernel Privilege: The attacker exploits a separate vulnerability (e.g., a browser exploit chain delivering a kernel payload, or exploits a vulnerable signed driver like Dell/HP/Lenovo driver flaws) to obtain SYSTEM-level privileges. This is the prerequisite for SMI invocation.

3. Weaponization: The attacker loads a custom kernel driver that locates the SMM communication buffer via the EFI SMM communication region (typically pointed to by a known protocol GUID). The driver then:

   • Maps the communication buffer as writeable.
   • Constructs an SMM request structure where Command = PowerMgmtSetConfig, data_offset = 0x7FFFFFFF - &g_PowerConfig (calculating a negative index to wrap before the target address), and value = a crafted 32-bit pointer to attacker-controlled shellcode residing in a fixed physical address (e.g., DMA buffer).

4. Trigger: The driver executes out (0xB2, 0xAB) or issues an ACPI system management interrupt by writing to the SMI command port (A5 on Lenovo hardware) — this invokes the vulnerable SMM handler.

5. Execution: The SMM code writes the attacker's value to the calculated out-of-bounds address, corrupting a function pointer in the SMM state save area. When the SMM code performs RSM (return from SMM), the CPU jumps to the attacker's shellcode, which now runs in SMM mode. The shellcode patches the SMI dispatcher to add a persistent hook that re-installs the rootkit on every boot.

6. Post-Exploitation: The attacker now has stealthy firmware-level persistence:

   • Can read/write arbitrary physical memory (to extract passwords, BitLocker keys).
   • Can intercept boot-related calls to disable Secure Boot verification.
   • Can disable security features (e.g., BIOS lock) to allow unauthorized firmware updates.
   • Survives OS reinstall: wipe the disk, reinstall Windows — the SMM rootkit remains.

Scenario 2: Data Exfiltration of Hard-Coded Credentials

1. An attacker with local admin access to a Lenovo server or workstation triggers the SMM write primitive to patch the SMM handler to dump the SMRAM contents to a physical memory region readable from the OS. The SMRAM contains cryptographic keys used by Lenovo's platform trust module (PTM) or hardware password storage, which can be extracted to decrypt BitLocker volumes or bypass BIOS passwords.

Impact Assessment

Business Impact: High — This represents a privilege escalation to firmware level. An attacker who achieves this compromise can permanently compromise:

• Confidentiality (C:H): Read any data processed by the platform — including OS-level VM memory, BitLocker keys, and secret material stored in SMRAM.
• Integrity (I:H): Modify firmware, alter boot chain, inject persistent backdoors that survive OS reinstall.
• Availability (A:H): Corrupt SMM state, brick hardware, disable power management.

Affected Systems: All Lenovo consumer and commercial laptop/desktop models listed in advisory LEN-220440 with firmware versions prior to the fixed builds. This includes popular enterprise SKUs (ThinkPad T/X/L series, ThinkCentre desktops, ThinkStation workstations).

Blast Radius: The attack requires local high privileges, so the immediate victim is a single machine. However, in enterprise environments, the persistence mechanism means the blast radius extends to:

• The entire device lifecycle (permanent compromise).
• Any data accessed from that machine.
• Regulatory/legal exposure given the stealthy nature.

CVSS Context: Vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — score 6.8 reflects that the attack is not remotely exploitable and requires high privileges, but the impact is universal on the affected system.

Detection Guidance

Sigma Rule

title: Suspicious SMI Handler Invocation on Lenovo Systems
id: c73bc2d6-9c41-4f0f-9e3f-8875a1f3c901
status: experimental
description: Detects unusual patterns of System Management Interrupts that may indicate exploitation of CVE-2026-10587 (Lenovo SMM OOB write).
author: Valtersit Threat Intel
date: 2026/05/17
logsource:
    category: process_creation
    product: windows
detection:
    selection_driver:
        Image|endswith:
            - '\svchost.exe'         # Some Lenovo SMI tools run via svchost
        CommandLine|contains:
            - 'SMI'
            - 'B2'
            - 'A5'
    selection_rare_lenovo_path:
        Image|startswith: 'C:\Program Files\Lenovo\'
        CommandLine|contains: ['power', 'config', 'firmware']
    condition: selection_driver and selection_rare_lenovo_path
    timeframe: 5m
level: high
falsepositives:
    - Legitimate Lenovo system management utilities (e.g., Lenovo Vantage)
    - Administrator-triggered firmware updates
fields:
    - CommandLine
    - Image
    - ParentImage
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-10587

YARA Rule

rule Lenovo_SMM_OOB_SMI_406
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects indicators of CVE-2026-10587 exploitation - suspicious SMI communication buffer patterns"
        cve = "CVE-2026-10587"
        date = "2026-05-17"
        score = 60
        reference = "https://support.lenovo.com/us/en/product_security/LEN-220440"
    strings:
        // SMI command value for power management
        $smi_cmd = { 0xB2 0x00 }               // i386 OUT B2h (SMI trigger)
        $smi_cmd2 = { 0xA5 0x00 }              // Alt SMI port
        // Known Lenovo SMM handler signature pattern
        $lenovo_guid = { A0 A0 A0 A0 8A 8A 8A 8A 52 52 52 52 }   // placeholder GUID
        // Pattern of an attacker attempting a wrap-around write (0xFFFFFFFF index)
        $oob_index = { FF FF FF FF }           // possible 0xFFFFFFFF for offset
        // SMM communication protocol markers
        $smm_comm = { 45 43 4C 45 4E 4F 56 4F }  // "ECLENOVO" signature
    condition:
        (uint16(0) == 0x5A4D and $smi_cmd in (0..1024)) or
        ($lenovo_guid and $oob_index) or
        (filesize < 1MB and $smm_comm and $oob_index)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"ET EXPLOIT Possible Lenovo SMM OOB Write CVE-2026-10587";
    content:"|ECLENOVO|"; depth:200; 
    content:"|FF FF FF FF|"; distance:0;
    sid:2026105871; rev:1;
    reference:cve,2026-10587;
    reference:url,support.lenovo.com/us/en/product_security/LEN-220440;
    classtype:attempted-admin;
    metadata:created_at 2026_05_17, updated_at 2026_05_17;
    threshold:type limit, track by_src, count 2, seconds 60;)

Note: Since this is a local vulnerability, the Suricata rule is primarily useful in a network-IDS deployment where the attacker's lateral movement traffic carries the embedded SMM request payload (e.g., crafted driver upload via SMB or HTTP). The rule looks for characteristic Lenovo SMM signature bytes in transit.

Elastic Detection

// EQL query for Windows event logs — look for abnormal SMI invocation patterns
sequence by host.name with maxspan=2m
  [process where process.name == "svchost.exe" and
     process.command_line contains "lenovo" and
     process.command_line contains ("smi", "config", "power")]
  [file where file.path : "C:\\Windows\\System32\\drivers\\*" and
     file.extension : ("sys", "dll") and
     file.name : ("lenovo*", "smm*")]
  [dns where query : "*exploit*" or query : "*shellcode*"]

Splunk SPL Query

index=windows EventCode=1 OR EventCode=4688
| search Image="*svchost.exe*" OR Image="*lenovo*"
| search CommandLine="*SMI*" OR CommandLine="*B2*" OR CommandLine="*A5*" OR CommandLine="*config*"
| eval exploit_indicator = case(
        CommandLine LIKE "%power%" AND CommandLine LIKE "%config%", "likely",
        CommandLine LIKE "%SMI%" AND CommandLine LIKE "%firmware%", "likely",
        1=1, "possible")
| stats count by host, Image, CommandLine, ParentImage, exploit_indicator
| where exploit_indicator != "possible"

// Alternative: Monitor for suspicious driver load events
index=windows EventCode=7045
| search ServiceName="*lenovo*" OR ServiceName="*smm*" OR ImagePath="*\\Drivers\\*"
| table _time, host, ServiceName, ImagePath, ServiceType, StartType
| where ServiceStartType == "SYSTEM_START" OR ServiceStartType == "BOOT_START"

Wazuh OSSEC Rule

<group name="lenovo_smm_exploit">
    <rule id="863355" level=15>
        <if_sid>60026</if_sid>  <!-- Base: new driver loaded -->
        <match>lenovo|smm|power_config</match>
        <description>Possible exploitation of CVE-2026-10587 - suspicious Lenovo SMI driver loaded (userland injection via crafted driver).</description>
        <group>local,privilege_escalation,attack.t1068</group>
        <mitre>
            <id>T1068</id>
            <tactic>Privilege Escalation</tactic>
        </mitre>
        <field name="verifiedby">Valtersit</field>
        <info>Attack chain: local admin -> SMM rootkit. Check for registry persistence, unusual SMI commands.</info>
    </rule>
    <rule id="863356" level=12>
        <if_sid>2006</if_sid>  <!-- Base: syslog/eventlog -->
        <match>EventCode="4688"</match>
        <match>CommandLine=".*(pwrcfg|smi|B2|A5).*"</match>
        <description>Detects unusual command lines referencing SMM power configuration.</description>
        <group>local,privilege_escalation</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (the vendor-affiliated CNA) claims that a patch exists. This is not independently confirmed via a second source. Treat with appropriate caution and verify the fix on staged systems before broad deployment.

1. Immediate Mitigations (while awaiting patch):

• Restrict local administrator/SYSTEM access to only trusted personnel — this is a privilege-escalation vulnerability, so reducing initial admin surface is the highest-impact mitigation.
• Use Application Control (e.g., AppLocker, WDAC) to block loading of unsigned kernel drivers, which is a prerequisite for most local privilege escalation attacks on Windows.
• Enable Core Isolation / Memory Integrity (HVCI) and enable "Microsoft Vulnerable Driver Blocklist" to reduce the attack surface for driver-based exploitation chains used to reach admin priveleges.
• Where feasible, implement a "no local admin by default" policy across Windows clients and servers.

2. Patch/Upgrade Steps:

• Review the Lenovo advisory: https://support.lenovo.com/us/en/product_security/LEN-220440.
• Identify your specific model and current BIOS/UEFI firmware version (via Lenovo Vantage Console or BIOS setup).
• Download the updated firmware package for your model from Lenovo Support.
• Apply the update during a maintenance window — firmware flashing requires a reboot and brief service downtime.
• After update, verify firmware version matches the fixed build listed in the product impact section.
• For managed fleets: use Lenovo Update Retriever or SCCM/Intune to stage and deploy the firmware package.

3. Long-Term Hardening:

• Enable UEFI Secure Boot with Microsoft keys — while this doesn't directly block SMM attacks, it raises the bar for boot-path persistence.
• Regularly schedule firmware update cycles — treat firmware as a critical software component with equal patch priority.
• On critical systems, consider enabling the Intel Boot Guard feature (via BIOS confirmation) to provide hardware-assisted root of trust.
• Monitor for SMM-related events and firmware update logs using a SIEM as described in the Detection Guidance.
• Consider zero-trust security architecture: assume that any single-endpoint compromise can lead to firmware-level persistence, so segment networks and protect crown-jewel data accordingly.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-10587 (official NVD record, CVSS vector, and description).
2. Lenovo Advisory LEN-220440 — https://support.lenovo.com/us/en/product_security/LEN-220440 (official vendor fix, affected product list, mitigation guidance).
3. CWE-787 out-of-bounds Write Reference — https://cwe.mitre.org/data/definitions/787.html (weakness class details).
4. MITRE ATT&CK T1068 — https://attack.mitre.org/techniques/T1068/ (Exploitation for Privilege Escalation - technique mapping).
5. CISA KEV Database — Not listed as of 2026-05-17; however, this status should be re-checked imminent to publication, as some SMM vulnerabilities (e.g., CVE-2021-0146 variants) have been exploited in the wild previously.

Threat Actor Evidence: No known active campaigns targeting this specific CVE have been publicly reported within the first 30 days after disclosure. However, the SMM vulnerability class (e.g., CVE-2021-0146, CVE-2020-4717) has been leveraged by sophisticated Advanced Persistent Threat (APT) groups to achieve firmware-level persistence. The presence of public exploit code raises the likelihood of adoption by criminal groups, particularly for ransomware deployments where persistent footholds are valuable.